Schedule A Meeting
Schedule A Meeting

CPS 234 Penetration Testing

Systematic Testing Evidence

Penva Security provides independent penetration testing aligned to CPS 234’s control-effectiveness requirements, helping regulated entities validate controls protecting critical and sensitive information assets.

We scope testing around changing threats, asset exposure, third-party dependencies and material system changes, then deliver clear deficiency reporting and verified remediation evidence.

Book a Free Scoping Call with US
  • Certified Testers
  • Security Compliance
  • Manual Pentesting
Pentest Report SCANNING COMPLETE
CPS 234 Control Test
scope: information assets · CVSS 3.1
Critical 3
High 6
Medium 9
Independent CPS 234 evidence generated
Control testing aligned to CPS 234.
Get Instant Quote
Instant estimate in about 30 seconds
CREST + OSCP testers CPS 234 evidence 100% Australian
Definition

What Is CPS 234 Penetration Testing?

CPS 234 penetration testing is an independent technical assessment used to test the design and operating effectiveness of information-security controls. It moves beyond policy review by checking whether an attacker can bypass access controls, exploit exposed systems or move between trusted environments.
The standard requires a systematic testing program whose nature and frequency reflect changes in threats, asset criticality, exposure to untrusted environments and material changes. It also places obligations on the entity where information assets are managed by related parties or third parties.

A well-scoped test produces evidence that can be used by control owners, risk teams, internal audit and the Board: what was tested, what failed, why it matters, how it should be fixed and whether remediation was independently verified.

Requirements

What CPS 234 Expects from Control Testing

The standard connects testing scope and frequency to risk, requires skilled and independent testers, and expects clear escalation and oversight of deficiencies.

Para 15

Security Capability

The entity must maintain information-security capability that is appropriate for its vulnerabilities, threats and the continued sound operation of the business.
Para 21

Controls Commensurate with Risk

Controls should reflect asset sensitivity, criticality, lifecycle, threats and the potential consequences of a security incident.
Para 26

Systematic Testing Program

Control effectiveness must be tested through a structured program rather than relying only on informal checks or self-assessment.
Para 27

Risk-Based Test Frequency

Testing depth and timing should reflect threat change, asset importance, untrusted exposure and material changes to information assets.
Para 28

Third-Party Testing Assurance

Where a third party manages assets, the entity must assess whether the provider’s testing is sufficient for the risks involved.
Para 29-31

Escalation, Independence and Review

Significant deficiencies require escalation, testing must use skilled independent specialists, and the testing program should be reviewed regularly.
How Penva Delivers

Mapped to the CPS 234 Assurance Process

Penva packages each engagement so the evidence can move cleanly from technical teams into risk, internal audit and governance reporting.

Para 21 Risk-Based Scope

A scope linked to asset criticality, sensitivity and exposure, including applications, APIs, cloud services, infrastructure and trusted connections.

Para 26 Control Effectiveness Evidence

Manual exploitation and control validation that shows whether preventive and detective safeguards work under realistic conditions.

Para 28 Third-Party Coverage

Authorised testing of externally managed assets and clear documentation of provider dependencies and testing limitations.

Para 29 Deficiency Reporting

Executive-ready reporting that highlights material weaknesses, affected assets, business consequences and remediation urgency.

Para 30 Independent Attestation

A signed letter recording tester qualifications, independence, scope, dates and methodology, followed by retesting to verify closure.
Instant Estimate Quote

Get an Instant Penetration Testing Estimate

Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.

Quote Builder Step 1 of 6
5 steps left
01

What type of penetration testing do you need?

Choose the main service you want quoted.

FAQ

CPS 234 Penetration Testing - Common Questions

Direct answers for teams building or reviewing a CPS 234 control-testing program. Updated July 2026.

Does CPS 234 specifically require penetration testing?

CPS 234 requires a systematic program to test the effectiveness of information-security controls. It does not prescribe one technique for every control, but APRA guidance identifies penetration testing as an example approach for validating network protection and exposed controls.

How is the penetration-test scope decided?

Scope should be based on asset criticality and sensitivity, changing threats, exposure to untrusted environments, the consequences of compromise and material system changes. This commonly prioritises internet-facing applications, critical APIs, cloud environments and privileged access paths.

How often should CPS 234 penetration testing be performed?

There is no single frequency for every asset. APRA expects testing frequency to be commensurate with risk and change. Guidance indicates a sufficient control population would normally be tested at least annually, while internet-exposed controls may need testing throughout the year.

Can we rely on a service provider’s penetration-test report?

You can use third-party assurance, but the regulated entity must assess whether its scope, quality and frequency are sufficient for the relevant assets. Independent testing may be needed where the provider report is limited, old or not aligned to your risks.

Who is allowed to perform CPS 234 testing?

The standard requires appropriately skilled and functionally independent specialists. Penva records the tester’s credentials, role, scope and methodology in the report and attestation letter.

How should serious findings be reported?

Findings should be prioritised by technical severity and business consequence. Deficiencies that cannot be remediated in a timely manner need a clear escalation path to senior management or the Board in line with the entity’s governance process.

Do you provide closure evidence?

Yes. One remediation retest within 60 days is included for fixed-price engagements. We repeat the relevant exploitation method and update the report so the entity can demonstrate whether the control deficiency has been resolved.

Get In Touch

Schedule a Call Today

Contact us